Subscribe Free
in Events

Aviation Africa 2018: Cyber security: Not if, but when

Posted 18 April 2018 · Add Comment

An airline’s greatest cyber-security threat may also be its most precious asset – its staff – according to panellists speaking at Aviation Africa in Cairo. Victoria Moores reports.

 

Hacking in to a company is no mean feat. The path of least resistance is often unsuspecting staff, who get caught out by cyber-security basics, such as password privacy or falling for phishing emails. This can lead to data theft, extortion, or worse, as national governments and criminals seek to exploit our 21st Century dependency on technology.

PGI managing director Brian Lord said employees are the easiest way into an organisation and the starting point for the most sophisticated attacks. “It is still the case that 80% of all global cyber attacks would have been stopped if human beings had been trained to operate properly,” he said.

Lord urged companies to improve basic training, run cyber-security incident exercises and carefully manage media fallout. “The damage of ineffective reporting carries just as much risk as the technical issues underpinning it,” he said.

Attackers use public fear and uncertainty stirred up by the media as a weapon in its own right, disabling and damaging the target company and tying up resources long after the technical problem is solved.

“The reaction to a disabling technical attack on an organisation is normally quite good. Where it falls down is their ability to manage that with the public, customers, shareholders and media. This is commercial damage; the technical damage is normally quite minimal.”

Aside from criminal attacks, countries are also developing their own cyber-attack capabilities and testing them. “This practice is happening all over the world,” Lord said. Unfortunately, airlines and airport are natural targets for both types of attack, because they form part of a country’s critical national infrastructure.

Simon Knechtli, who is executive director aerospace at insurance firm Willis Towers Watson, said the insurance industry is changing its approach to cyber threats and extending cover to include a network interruption option.

“There are only two types company: those that can be hacked and those that will be,” Knechtli said. “Don’t just refer us to the IT department. This is a business risk.”

He estimated the average cost of a data breach at $3.6 million. This is only likely to increase with the introduction of new European rules that carry a 4% of global revenue penalty for data leaks. “That is really focusing the mind of aviation companies,” he said.

Knechtli agreed that the main vulnerability to cyber attacks is employee negligence. “90% is human error. The major risk to be dealt with first are your own employees.”

Like Lord, he said companies should have a strategic plan when it comes to cyber security, including staff training.

Industry IT specialist SITA has collected 10 years of aviation cyber-attack data, profiling the attackers and their intentions. Hackers make up 40% of the total, with 32% being motivated by financial gain, said SITA global lead of business management Ahmed Fawzi. “A very important part of protecting the business is to get users aware, so they don’t get exploited,” he said.

Airlines need an action strategy, said Fawzi, but that plan will need constant revision. “This is not a one-time process. It is a repeat process that has to be ongoing, making sure you are constantly in the game and not falling behind at any time.” Fawzi announced that SITA is about to start a cyber-security benchmarking study and invited conference delegates to join the project.

One area of the business that is particularly sensitive to breaches is business aviation, said Africa Satcom Direct (SD) business development director Brian Roos. With this in mind, SD is able to provide passengers with end-to-end encryption via a private network and detect in-flight cyber attacks in real-time. The company is so confident in its security levels that it guarantees against cyber-attack losses.

Cyber attacks could come at any point in the supply chain, for example using hub airport vulnerability to disrupt airline operations. This need for cooperation among aviation stakeholders triggered the creation of non-profit members organisation ISAC, which exchanges threat information among its airline, airframer and supplier members.

“There is a shared risk here,” ISAC executive director Aviation Jeffrey Troy said. “The whole supply chain needs to talk to each other.” The top concern that ISAC members voice during their regular calls and four annual meetings is regulatory compliance.

Osprey Flight Solutions CEO Andrew Nicholson agreed that there is a benefit to sharing information. “Without proper information, you can’t do proper risk management because you can’t understand the risks,” he said. “It’s down to us, as an industry, to improve ways of sharing information and helping each other – that comes down to trust.” 

This is where big data can be turned into a benefit. Pooled risk data can give a clearer picture of the threat, improving the efficiency of the response. 

“If every operator shared a tiny bit of data, the overall improvement to risk management would be immense. It’s about crowdsourcing information to create a bigger picture of what is going on. Scaling information in that way can be hugely powerful,” Nicholson said.

While people were a common cause for cyber-risk concern, Nicholson said they are also part of the solution. “Human analysts play an extremely important part, because they can make links that computers can’t. It is about integration of humans and computers.”

PGI managing director Brian Lord

* required field

Post a comment

Other Stories
Advertisement
Latest News

Embraer foresees demand for 10,550 new aircraft with up to 150 Seats over next 20 years

Embraer forecasts demand for 10,550 new aircraft with up to 150 seats worldwide, worth USD 600 billion, over the next 20 years. The in-service fleet is set to increase to 16,000 aircraft, up from the 9,000 aircraft currently in operation.

Gulfstream G500 completes high-speed world tour

Gulfstream Aerospace has announced the all- new Gulfstream G500 recently wrapped up its world tour after flying nearly 130,000 nautical miles/240,760 kilometers, stopping at 44 cities and visiting 18 countries on six continents in

Emirates receives IATA 753 compliance certification for baggage

Emirates has been awarded IATA 753 compliance certification for its baggage operation in its home base of Dubai.

FIA2018: Wataniya Airways to add 25 A320neo

At the Farnborough International Airshow (FIA) today, Rakan Al-Tuwaijri, Chief Executive Officer of Golden Falcon Aviation - the exclusive aircraft provider of Wataniya Airways - and Eric Schulz, Airbus Chief Commercial Officer,

Flight Fan-tastic?

The XTI Aircraft Company exhibited a one-third scale model of its planned TriFan 600 aircraft at the inaugural Kuwait Aviation Show in January 2018, as part of the company’s ambitious equity-based crowdsourced funding campaign. Jon

FIA 2018: Qatar Airways finalise order for Five 777 freighters

Boeing and Qatar Airways finalised an order for five 777 Freighters at the 2018 Farnborough International Airshow. The deal, valued at $1.7 billion at current list prices, was announced as a commitment in April.

TAA SK0902311218
See us at
AIME19BTA3005120219GATM BT1004061118MAPS18_BT1207131118Istanbul Airshow BT22018ASDubai BT1004091018MEBAA BT1004121218Cargo BT1004091018Aviation Africa BT0607280219BIAS BT271017161118